Wireless Access

I have inherited a network with a centralized controller and 100+ APs across 15 locations.  The APs are on switch trunk ports and access ports across the sites, sometimes both in the same site.  What madness.  Shouldn't it be one or the other?  Which?  Yes, there are more than one VLAN (3) and each is related to a separate SSID.

Are these APs tunneling clients to a controller or are they instant APs?

If I am tunneling clients to a controller I put the APs on access ports. If I am bridging wireless clients to multiple VLANs using instant access points and no controller, I use a trunk port. 

Controller or no controller?

You will need to check your config but most likely you are tunneling all wireless client traffic to the dc. In that case the access points themselves could be on an access port. 

If you care at all about WIDS / detecting rogue APs you should set the interface to trunk and native VLAN to the VLAN you want the APs to pass traffic on. It's important for the APs to recieve the broadcast traffic on the other VLANs particularly the wired VLAN in the same coverage areas where someone may potentially plug in a rogue AP. Also ensure STP is disabled on AP ports.

RSTP is ok right?

Good point, all Internet content filtering is done at the dc on the FW there.  There is no internet at the remote sites, so servers either.  But there is local printing.

Great point Marcus! That's not usually on my mind but is true and a good Idea if WIDS is important to them. :-) 

Also, Big Welcome to the Community :-)